CVE-2021-22795: OS Command Injection

Q: What is CVE-2021-22795?

CVE-2021-22795 is a vulnerability related to Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).

Q: What is the severity of CVE-2021-22795?

The severity of CVE-2021-22795 is critical with a CVSS score of 9.8.

Q: Which product is affected by CVE-2021-22795?

The affected product is StruxureWare Data Center Expert (V7.8.1 and prior) from Schneider-electric.

Q: How does CVE-2021-22795 work?

CVE-2021-22795 allows for remote code execution when performed over the network by exploiting a command injection vulnerability.

Q: How can I fix CVE-2021-22795?

To fix CVE-2021-22795, upgrade to a version of StruxureWare Data Center Expert that is higher than V7.8.1.

Published Mar 28, 2022

Updated

A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)

Affected Software

1 affected component

Schneider-electric Struxureware Data Center Expert<=7.8.1

Event History

Mar 28, 2022

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2021-22795?

CVE-2021-22795 is a vulnerability related to Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).

What is the severity of CVE-2021-22795?

The severity of CVE-2021-22795 is critical with a CVSS score of 9.8.

Which product is affected by CVE-2021-22795?

The affected product is StruxureWare Data Center Expert (V7.8.1 and prior) from Schneider-electric.

How does CVE-2021-22795 work?

CVE-2021-22795 allows for remote code execution when performed over the network by exploiting a command injection vulnerability.

How can I fix CVE-2021-22795?